fix(pair): specific error detail for expired vs invalid pairing code

shard_core/web/public/pair.py

@@ -25,9 +25,18 @@
 async def add_terminal(code: str, terminal: InputTerminal, response: Response):
     try:
         await pairing.redeem_pairing_code(code)
-    except (KeyError, pairing.InvalidPairingCode, pairing.PairingCodeExpired) as e:
+    except pairing.PairingCodeExpired as e:
         log.info(e)
-        raise HTTPException(status.HTTP_401_UNAUTHORIZED) from e
+        raise HTTPException(
+            status.HTTP_401_UNAUTHORIZED,
+            detail="This pairing code has expired. Generate a new code on your shard and try again.",
+        ) from e
+    except pairing.InvalidPairingCode as e:
+        log.info(e)
+        raise HTTPException(
+            status.HTTP_401_UNAUTHORIZED,
+            detail="This pairing code is not valid.",
+        ) from e
 
     new_terminal = Terminal.create(terminal.name)
     async with db_conn() as conn:

tests/test_terminals.py

@@ -103,6 +103,7 @@ async def test_pairing_two_with_same_name(app_client: AsyncClient):
 async def test_pairing_no_code(app_client: AsyncClient):
     response = await add_terminal(app_client, "somecode", "T1")
     assert response.status_code == 401
+    assert response.json()["detail"] == "This pairing code is not valid."
 
     response = await app_client.get("protected/terminals")
     assert len(response.json()) == 0
@@ -113,18 +114,32 @@ async def test_pairing_wrong_code(app_client: AsyncClient):
 
     response = await add_terminal(app_client, f'wrong{pairing_code["code"][5:]}', "T1")
     assert response.status_code == 401
+    assert response.json()["detail"] == "This pairing code is not valid."
 
     response = await app_client.get("protected/terminals")
     assert len(response.json()) == 0
 
 
+async def test_pairing_wrong_code_does_not_leak_valid_code(app_client: AsyncClient):
+    pairing_code = await get_pairing_code(app_client)
+
+    wrong_code = f'{(int(pairing_code["code"][0]) + 1) % 10}{pairing_code["code"][1:]}'
+    response = await add_terminal(app_client, wrong_code, "T1")
+    assert response.status_code == 401
+    assert pairing_code["code"] not in response.text
+
+
 async def test_pairing_expired_code(app_client: AsyncClient):
     pairing_code = await get_pairing_code(app_client, deadline=1)
 
     sleep(1.1)
 
-    response = await add_terminal(app_client, pairing_code, "T1")
+    response = await add_terminal(app_client, pairing_code["code"], "T1")
     assert response.status_code == 401
+    assert response.json()["detail"] == (
+        "This pairing code has expired. Generate a new code on your shard and try again."
+    )
+    assert pairing_code["code"] not in response.text
 
     response = await app_client.get("protected/terminals")
     assert len(response.json()) == 0